Configuring security profiles Fortigate

[Geert_m]

Hello,

I am planning to configure security profiles in some of the firewall policies that are on my FortiGate. My question about this is, if I need a valid/signed certificate installed on Fortigate and my hosts to inspect all traffic passing the FortiGate in order to inspect all data from packets and block certain traffic because it contains malware etc?

How does this work, can someone explain me?

Kind regards,

 Geert

[ozkanaltas]

Hello @Geert_m ,

As you know at present almost all internet traffics are using SSL. Because of that Fortigate doesn't inspect these traffics without ssl-inspection. 

You don't need the signed certificate for ssl-inspection. You can create one CA certificate via your AD, OpenSSL or you can use the default Fortigate CA certificate. But if you use not signed certificate you need to deploy this certificate to your client's computer certificate store for your client's comfort. 

if you have a more question about SSL inspection, you can ask without hesitation.

Also, you can review these articles about ssl-deep inspection. 

https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/605938/why-you-should-use-ssl-inspection

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/122078/deep-inspection

[Geert_m]

I configured a firewall policy that has web filtering enabled. When adding the web filtering security profile, I need to enable SSL inspection as well in the new firewall policy. So I enabled this and added the CA Certificate to my webbrowser its trust-chain.

But when I try to access Facebook, I get the warning above.

What am I doing wrong here?

[ozkanaltas]

Hello @Geert_m ,

Can you try to import the certificate to the Windows certificate store? After that, you need to do one more thing for Firefox (another browser does not need this setting). 

Windows Enterprise Support
Starting with version 49, Firefox can be configured to automatically search for and import CAs that have been added to the Windows certificate store by a user or administrator.

Type about:config in the address bar and press Return.
A warning page may appear. Click Accept the Risk and Continue to go to the about:config page.
Search for the security.enterprise_roots.enabled preference.
Click the Toggle Fx71aboutconfig-ToggleButton button next to this preference to change its value to true.
Restart Firefox.

Also, you can review this document about how to install CA cert on a Windows system.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-a-FortiGate-nbsp-deep-SSL/ta...

[Geert_m]

Well I am configuring all of this in GNS3 with a FortiGate VM. I have a Debian based host on the local network. So I can't import the .cer file in Windows. Do you have any information on how to add this  certificate in Debian?

[ozkanaltas]

Hello @Geert_m ,

I didn't try before but I found a command for this. 

copy certificate file to this path : 

/usr/local/share/ca-certificates/

After that, run this command. 

update-ca-certificates

[Geert_m]

Thanks, I did come across these commands myself. I added the .crt file and updated the CA store. Nothing changed. I guess I will try something else.

[ozkanaltas]

Do you have any chance to try with Google Chrome? Because firefox works a bit differently. 

[Geert_m]

Yes, I am installing it on the host. Only problem is that the download speed is a bit slow, so it will take some time.

[Geert_m]

@ozkanaltas 
I have tried to get it working. But I couldn't figure it out. It is not as big of a problem. The only question that I have left is the following:

When do I need to use SSL certificate inspection and when do I need to use Full SSL inspection? Are there security profiles that require you to have Full SSL inspection configured?

And what can proxy-based inspection that flow-based inspection cannot? Does proxy-based inspection require Full SSL inspection in order to work?